CareSwaps, LLC ("CareSwaps," "we," "us," or "our") is a healthcare technology platform providing algorithmic transfer matching software services. This Privacy Policy describes how we collect, use, store, share, and protect information submitted through the CareSwaps website, subscription platform, and associated services.
CareSwaps operates as a HIPAA Business Associate — not a Covered Entity. When our services involve Protected Health Information (PHI), we are bound by a Business Associate Agreement (BAA) with each participating facility and comply with 45 CFR Parts 160–164.
For detailed information about PHI, your rights under HIPAA, and our role as a Business Associate, please see our HIPAA Notice of Privacy Practices. This Privacy Policy governs general website, account, billing, and marketing data. The HIPAA Notice governs PHI specifically.
cs_cookie_consent).When a participating facility shares availability or operational data with the platform, or when we receive data from service providers in the course of delivering our services (for example, payment-status updates from Stripe), we integrate that information under the terms of the applicable BAA, DPA, or service agreement.
We do not sell personal data. We do not use PHI for advertising or marketing. We do not use PHI to target content.
Once a family opts into outreach, CareSwaps may share de-identified operational signals and geographic demand information with non-member facilities to notify them of interest. PHI is not shared with any facility that has not signed a BAA. After both facilities join the network (sign TSA + BAA), the algorithm reveals the match under the applicable BAA terms.
| Provider | Role | Agreement | PHI Access |
|---|---|---|---|
| Google Workspace | Email, Sheets (Master PHI DB), Drive, Apps Script | BAA (signed March 11, 2026) | Yes |
| Jotform (HIPAA Gold) | Intake form collection | BAA | Yes |
| Paubox | Encrypted outbound email for PHI | BAA | Yes |
| Stripe | Payment processing | DPA (payment processor exemption) | No |
| Cloudflare | DNS, CDN, edge hosting | DPA | No |
| Airtable | Operational database (de-identified IDs only) | Standard DPA | No |
| Make.com | Workflow automation (de-identified IDs only) | Standard DPA | No |
We may disclose information when required by law, to comply with a valid subpoena or court order, to protect the rights, safety, or property of CareSwaps or others, or to investigate fraud or security incidents. For PHI, all such disclosures are made in accordance with 45 CFR § 164.512.
If CareSwaps is acquired, merges with another entity, or undergoes a significant corporate transaction, customer information may transfer to the successor entity, subject to this Privacy Policy and all applicable BAAs.
We do not sell personal data or PHI.
We maintain administrative, physical, and technical safeguards designed to protect personal information and PHI, including role-based access controls, encryption in transit (TLS 1.2+) and at rest, multi-factor authentication for administrative accounts, audit logging, and periodic risk assessments.
Retention periods vary by data type. HIPAA-related records are retained for a minimum of six (6) years. Tax and financial records are retained for seven (7) years. Anti-Kickback Statute documentation is retained indefinitely. For the complete schedule, see our Data Retention Schedule.
CareSwaps uses a minimal cookie set. Our cookie banner gives you the choice to accept or decline analytics cookies. If you decline, we will not load Google Analytics. Essential session cookies required for the site to function are not controlled by the banner.
Our analytics configuration uses IP anonymization. We do not use cross-site tracking cookies, advertising cookies, or third-party marketing pixels.
Colorado residents have the right to:
To exercise any of these rights, email privacy@careswaps.com. We will respond within forty-five (45) days.
If your request relates to PHI, please see our HIPAA Notice of Privacy Practices, which describes your rights to access, amendment, accounting of disclosures, and restrictions on use.
If we deny your request, you may appeal by replying to our denial email. If we deny your appeal, you may file a complaint with the Colorado Attorney General at coag.gov or, for PHI matters, with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr.
CareSwaps is a service for adult family members arranging senior-care transfers. Our services are not directed to children under 13, and we do not knowingly collect personal data from children. If you believe a child has submitted information to us, please contact privacy@careswaps.com and we will delete it.
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version with a new effective date and, where required by law, provide notice by email to active subscribers. Continued use of CareSwaps after the effective date constitutes acceptance of the updated policy.
This Privacy Policy is governed by the laws of the State of Colorado, without regard to its conflict-of-laws principles. For disputes, see our Terms of Service.
For privacy questions, rights requests, or to report a concern, contact us:
Regulatory complaints: HHS Office for Civil Rights — hhs.gov/ocr (PHI) · Colorado Attorney General — coag.gov (CPA).